CVE-2004-1476

Severity: medium (CVSS 5.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2004-12-31 · updated 2026-06-16

Description

Stack-based buffer overflow in the VideoCD (VCD) code in xine-lib 1-rc2 through 1-rc5, as derived from libcdio, allows attackers to execute arbitrary code via a VideoCD with an unterminated disk label.

Affected products

Suse Linux: 8.0, 8.1, 8.2, 9.0, 9.1, 9.2
Xine: 0.9.18, 1_rc2, 1_rc3, 1_rc4, 1_rc5
Xine-Lib: 0.99, 1_rc2, 1_rc3, 1_rc4, 1_rc5

References

http://www.gentoo.org/security/en/glsa/glsa-200409-30.xml
http://www.securityfocus.com/archive/1/375485/2004-09-02/2004-09-08/0
http://www.securityfocus.com/bid/11206
http://xinehq.de/index.php/security/XSA-2004-4
https://exchange.xforce.ibmcloud.com/vulnerabilities/17431
http://www.gentoo.org/security/en/glsa/glsa-200409-30.xml
http://www.securityfocus.com/archive/1/375485/2004-09-02/2004-09-08/0
http://www.securityfocus.com/bid/11206
http://xinehq.de/index.php/security/XSA-2004-4
https://exchange.xforce.ibmcloud.com/vulnerabilities/17431

Get alerted when CVE-2004-1476 or the next vulnerability affects your stack